safari can't open certain websites

You may have installed one or more variants of the "VSearch" ad-injection malware. Please back up all data, then take the steps below to inactivate it.

Don't use any kind of "anti-virus" or "anti-malware" product on a Mac. There is never a need for it, and relying on it for protection makes you more vulnerable to attack, not less.

Malware is always changing to get around the defenses against it. This procedure works as of now, as far as I know. It may not work in the future. Anyone finding this comment a few days or more after it was posted should look for a more recent discussion, or start a new one.

The VSearch malware tries to hide itself by varying the names of the files it installs. To remove it, you must first identify the naming pattern.

1. Triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:

/Library/LaunchDaemons

In the Finder, select

Go ▹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You may not see what you pasted because a line break is included. Press return.

A folder named "LaunchDaemons" may open. If it does, press the key combination command-2 to select list view, if it's not already selected.

There should be a column in the Finder window headed Date Modified. Click that heading twice to sort the contents by date with the newest at the top. Please don't skip this step. Files that belong to an instance of VSearch will have the same modification time to within about one minute, so they will be clustered together when you sort the folder this way, making them easy to identify.

Look inside the folder for files with a name of any of these forms:

com.something.daemon.plist

com.something.helper.plist

com.something.net-preferences.plist

Here something is a meaningless, random string of characters, which can be different in each instance of VSearch. So far it has always been an alphanumeric string without punctuation, such as "disbalance" or "thunderbearer."

You could have more than one copy of the malware, with different values of something.

There may also be one or more files with a name of this form:

com.somethingelseUpd.plist

where somethingelse may be a different meaningless string than something. Again, there may be more than one such file, with different values of somethingelse.

Here's a typical example of a VSearch infection:

com.disbalance.net-preferences.plist

com.thunderbearerUpd.plist

You will have files with names similar, but probably not identical, to these.

If you feel confident that you've identified the above files, drag just those files—nothing else—to the Trash. You may be prompted for your administrator login password. Close the Finder window.

2. Open this folder as in Step 1:

/Library/LaunchAgents

Move to the Trash any files with a name of the form

com.something.agent.plist

where something is one of the strings you found in Step 1. There may not be any such files.

3. If you moved anything to the Trash in Step 1 and/or Step 2, restart the computer and empty the Trash.

Don't delete the "LaunchAgents" or "LaunchDaemons" folder, or anything else inside either one, unless you know you have some other kind of unwanted software besides VSearch. The folders are a normal part of OS X. The terms "agent' and "daemon" refer to a program that starts automatically. That's not inherently bad, but the mechanism is sometimes exploited by malware attackers.

4. Reset the home page in each of your browsers, if it was changed. In Safari, first load the home page you want, then select

Safari ▹ Preferences... ▹ General

and click

Set to Current Page

The malware is now permanently inactivated, as long as you never reinstall it. A few small files will be left behind, but they have no effect, and trying to find them all is more trouble than it's worth.

5. If you didn't find the files or you're not sure about the identification, post what you found.

If in doubt, or if you have no backups, change nothing at all.

6. The trouble may have started when you downloaded and ran an application called "MPlayerX" or "PDF Pronto." If there is an item with either name in the Applications folder, delete it.

This trojan is often found on illegal websites that traffic in pirated content such as movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect more of the same, and worse, to follow. Never install any software that you downloaded from a bittorrent, or that was downloaded by someone else from an unknown source.

In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.

Then, still in System Preferences, open the App Store or Software Update pane and check the box marked

Install system data files and security updates (OS X 10.10 or later)

or

Download updates automatically (OS X 10.9 or earlier)

if it's not already checked.

Safari - Unsupported third-party add-ons may cause Safari to unexpectedly quit or have performance issues

Safari doesn't load a page or webpage items are missing

Safari/other browsers – Website not loading

Please read this whole message before doing anything.

This procedure is a diagnostic test. It’s unlikely to solve your problem. Don’t be disappointed when you find that nothing has changed after you complete it.

The purpose of the test is to determine whether the problem is caused by third-party software that loads automatically at startup or login, by a peripheral device, by a font conflict, or by corruption of the file system or of certain system caches.

Disconnect all wired peripherals except those needed for the test, and remove all aftermarket expansion cards, if applicable. Start up in safe mode and log in to the account with the problem.

Note: If FileVault is enabled in OS X 10.9 or earlier, or if a firmware password is set, or if the startup volume is a software RAID, you can’t do this. Ask for further instructions.

Safe mode is much slower to start up and run than normal, with limited graphics performance, and some things won’t work at all, including sound output and Wi-Fi on certain models. The next normal startup may also be somewhat slow.

The login screen appears even if you usually login automatically. You must know your login password in order to log in. If you’ve forgotten the password, you will need to reset it before you begin.

Test while in safe mode. Same problem?

After testing, restart as usual (not in safe mode) and verify that you still have the problem. Post the results of the test.

I'm no expert for sure, but after downloading the latest OS update yesterday (El Capitan 10.11.14), I had problems visiting certain websites that I know to be "safe". It didn't matter if I used Chrome, Safari, or Firefox; they simply wouldn't load and would say that the sites were unresponsive. However, my iPhone on the same network could access these sites with no problems whatsoever. I even pinged them in Terminal and got a quick response, so I knew something was blocking them in my browsers. Malwarebytes found nothing, so I felt pretty confident that it was not a Malware issue. I ran a virus scan yesterday, too, and no problems there.

I cleared my browser history, cookies, etc., flushed my DNS cache, added DNS settings, etc., all to no avail. Finally I saw on some antivirus program's site forum that people using that program had similar browsing problems after January's update. They were advised to deactivate the antivirus until the company could update it to work properly with the updated OS.

So I uninstalled my antivirus software, which I'd wanted to get rid of anyway, and voila! Everything works fine now. The previously problematic sites load super quickly on Chrome. It only took me about three hours to figure that out. Now off to get something better.

I hope this works for you!

Hi Linc

I had the same problem, all of a sudden certain webpages would't load anymore. I tried virtually everything that I could find in Mac discussions related to this issue on the web (one sleepless night), but it seemed that getting rid of the hidden malware in "LaunchDaemons" was the key (at least in my case). Now it's working again. I'm very impressed by your skills, many thanks for your post that has been extremely helpful.

Cheers

Danny

Go to Safari>Preferences>Advanced and check the box that shows Developer Menu.

Then go to Safari>Develop and Empty Caches

Next go to Safari>Develop and disable extensions

Open Network Preferences and select the connected network (e.g., wifi and click on Advanced then click on the DNS tab.

Try changing it to Google's 8.8.8.8